Phoenix 24
GLOBAL CYBERSECURITY — October 31, 2026. Cybersecurity researchers have uncovered an extensive network of 319 Google Chrome extensions that secretly manipulate users’ internet searches, routing queries through servers controlled by third-party operators to generate advertising revenue. The campaign, associated with approximately 13.4 million installations over a decade, has raised significant concerns about digital privacy, browser security and the growing exploitation of legitimate software distribution platforms.
The findings were disclosed on October 29 by John Tuckner, a security researcher at Socket, a company specializing in software supply-chain security. The investigation, titled Searchjacked, expands on research conducted in April 2025, when Tuckner identified an initial group of 57 suspicious Chrome extensions associated with approximately six million installations.
The latest analysis identified 264 additional extensions, accounting for roughly 8.7 million more installations. The combined findings demonstrate the scale of an operation that relied on apparently useful browser tools to redirect search traffic without users necessarily understanding how their browsing activity was being manipulated.
Unlike conventional malware that relies on exploiting operating-system vulnerabilities or installing unauthorized executable files, the extensions primarily abuse functionality already available within the browser. Once installed, they can modify the default search provider, replacing the user’s preferred configuration with a system designed to intercept and redirect search queries.
The mechanism exploits a browser extension configuration capability known as chrome_settings_overrides. This feature allows developers to specify certain browser preferences, including the default search engine, when their extensions are installed.
Although the capability has legitimate uses, the identified operators employed it to direct searches through infrastructure under their control. When a user entered a query into Chrome’s address bar, the request could pass through an intermediary server before being forwarded to an established search engine such as Yahoo or Bing.
To the user, the result might appear ordinary. A search would still produce familiar results, often from a recognized provider, giving little indication that the query had traveled through an additional system.
The redirection, however, introduced an important security and privacy concern. Intermediary operators could receive information about search activity while obtaining referral payments through commercial arrangements associated with the final search destination.
Researchers found that the extensions used syndication partner identifiers to associate redirected traffic with particular operators. These identifiers facilitated the attribution of searches for advertising-related compensation, turning browser configuration manipulation into a potentially profitable business model.
The activity illustrates a form of search hijacking, in which software changes a user’s search environment to benefit an external operator rather than respecting the user’s intended preferences.
The financial motivation is especially significant because it distinguishes the documented campaign from attacks whose primary objective is direct theft of banking credentials or the deployment of ransomware. In this case, the observed mechanism centered on capturing and monetizing search traffic.
Nevertheless, the risks extend beyond advertising revenue.
By controlling the intermediary destination through which searches pass, the operators could potentially alter how users reach information. Researchers warned that the same infrastructure could be redirected toward fraudulent websites, phishing pages or malicious downloads.
Such possibilities should be distinguished from confirmed activity. The investigation established the interception and redirection of search queries, but did not demonstrate that all 319 extensions had actively delivered malware, stolen passwords or redirected users to phishing websites.
This distinction is essential because the severity of a cybersecurity incident depends on documented behavior as well as plausible future exploitation.
Even when searches ultimately reach legitimate providers, the exposure of queries to unauthorized intermediaries can create significant privacy concerns. Search histories may reveal information about professional activities, financial interests, personal circumstances and sensitive subjects.
The ability to observe search activity also introduces possibilities for behavioral profiling. A collection of seemingly unrelated queries can reveal patterns concerning an individual’s interests, habits and information needs.
The campaign relied heavily on deception surrounding the advertised functions of the extensions.
Researchers identified add-ons promoted as PDF converters, instruction-manual search tools, safer browsing utilities and artificial intelligence search assistants. These categories are attractive because they correspond to routine activities performed by students, professionals and ordinary internet users.
The apparent simplicity of the advertised functions helped reduce suspicion. A user searching for a PDF conversion tool or an online manual might regard a browser extension as a convenient solution without examining the permissions or configuration changes involved.
The distribution strategy also exploited paid advertising. The operators promoted extensions through advertising networks, including Google Ads and other platforms, directing potential users toward installation pages.
One of the investigation’s most consequential findings concerned the way these extensions appeared in the Chrome Web Store.
Many were classified as unlisted, meaning they could be accessed through direct links but would not ordinarily appear in the store’s public search results.
This arrangement allowed operators to use external advertisements to direct users toward installation pages hosted within Google’s official extension ecosystem. The presence of a listing in a recognized marketplace could create an appearance of legitimacy even when the underlying software performed questionable func